add view_permission decorator to backup_detail_view

network_inventory/inventory/tests/test_views/test_backup_detail_view.py

@@ -3,6 +3,7 @@ from mixer.backend.django import mixer
 from django.test import Client
 
 import helper
+from inventory.models import Customer
 
 pytestmark = pytest.mark.django_db
 
@@ -14,7 +15,7 @@ def test_backup_detail_view_not_logged_in():
 
 def test_backup_detail_view(create_admin_user):
     create_admin_user()
-    mixer.blend('inventory.Computer')
+    mixer.blend('inventory.Computer', customer=mixer.SELECT)
     backup = mixer.blend('inventory.Backup', computer=mixer.SELECT)
     client = Client()
     client.login(username="novartis-admin", password="password")
@@ -29,3 +30,16 @@ def test_backup_detail_view_not_found(create_admin_user):
     client.login(username="novartis-admin", password="password")
     response = client.get('/backup/100/')
     assert response.status_code == 200
+
+
+def test_customer_computer_table_no_permission(create_admin_user):
+    create_admin_user()
+    customer = Customer.objects.create(name='Nestle')
+    client = Client()
+    client.login(username="novartis-admin", password="password")
+    mixer.blend('inventory.Computer', customer=customer)
+    backup = mixer.blend('inventory.Backup', computer=mixer.SELECT)
+    response = client.get('/backup/' + str(backup.id) + '/')
+    assert response.status_code == 403
+
+

network_inventory/inventory/views.py

@@ -113,6 +113,7 @@ def backups_table_view(request, pk):
 
 
 @login_required
+@backup_view_permission
 def backup_detail_view(request, pk):
     backup = get_object_or_404(Backup, pk=pk)
     return render(request, 'inventory/backup_details.html', {'backup': backup})